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Abstract 

Suppose that a polynomial-time mixed-state quantum circuit, described as a sequence of 
local unitary interactions followed by a partial trace, generates a quantum state shared between 
two parties. One might then wonder, does this quantum circuit produce a state that is separable 
or entangled? Here, we give evidence that it is computationally hard to decide the answer to this 
question, even if one has access to the power of quantum computation. We begin by exhibiting a 
two-message quantum interactive proof system that can decide the answer to a promise version 
of the question. We then prove that the promise problem is hard for the class of promise 
problems with "quantum statistical zero knowledge" (QSZK) proof systems by demonstrating 
a polynomial-time Karp reduction from the QSZK-complete promise problem "quantum state 
distinguishability" to our quantum separability problem. By exploiting KnhTs efficient encoding 
of a matrix description of a state into a description of a circuit to generate the state, we can 
show that our promise problem is NP-hard. Thus, the quantum separability problem (as phrased 
above) constitutes the first nontrivial promise problem decidable by a two-message quantum 
interactive proof system while being hard for both NP and QSZK. We consider a variant of 
the problem, in which a given polynomial-time mixed-state quantum circuit accepts a quantum 
state as input, and the question is to decide if there is an input to this circuit which makes its 
output separable across some bipartite cut. We prove that this problem is a complete promise 
problem for the class QIP of problems decidable by quantum interactive proof systems. Finally, 
we show that a two-message quantum interactive proof system can also decide a multipartite 
generalization of the quantum separability problem. 



1 Introduction 

Quantum entanglement plays a central role in quantum information science [HHHH09]. It is be- 
lieved to be one of the reasons behind the computational power of quantum algorithms [EJ98], it can 
enhance the communication capacities of channels in fascinating ways [BSST99, BSST02, CLMW10, 



PLM+11] , most notably as exhibited in quantum teleportation |BBC + 93| and super-dense coding 
[BW92] , and it is a resource for device-independent quantum key distribution |Eke91[ IVV12j . For 
these reasons and others, the characterization and systematic understanding of entanglement have 
long been important goals of quantum information and complexity theory. 

Every quantum state has a mathematical description as a density operator p, which is a unit- 
trace, positive semidefinite operator acting on some Hilbert space T~L. (In this work, we restrict 



ourselves to finite-dimensional Hilbert spaces.) If the Hilbert space T~L has a factorization as a 
tensor product Ha <8> T~Lb of two Hilbert spaces T~La and 1~Lbi then we write the state p as pab and 
say that it is separable if it admits a decomposition of the following form: 

PAB = ^2pz(z) o z a® t b^ (!) 

for collections {cr^} and {r^} of quantum states and some probability distribution pz (z) over an 
alphabet Z [Wer89j. Let S denote the set of separable states. Often, we think of the systems 
A and B (corresponding to Hilbert spaces %a and %b) as being spatially separated, with an 
experimentalist Alice possessing system A, while her colleague Bob possesses system B. The 
intuition behind the above definition of separability is that a separable state can be prepared 
without any quantum interaction between systems A and B. That is, there is an effectively classical 
procedure by which they can prepare a separable state: Alice selects a classical variable z according 
to pz (2)5 prepares the state a z in her lab, and sends Bob the variable z so that he can prepare the 
state r z in his lab. After this process, they both discard the variable z, so that ([!]) describes their 
shared quantum state. It is clear from inspecting that the set of separable states is a convex 
set, and that any separable state has the following form as well: 

PAB = ^2px(x) \i/> x ) (*I>x\a®\<I>x) (<I>x\bi ( 2 ) 

x^X 

for collections {I^Ar)^} an d {\ ( ( ) x)b} °f P ure states and some probability distribution px (x) over an 
alphabet X of size no larger than dim('H) 2 , the cardinality bound following from Caratheodory's 
theorem [Hor97j. Finally, if the state pab does not admit a decomposition of the above form, then 
it is entangled — it can only be prepared by a quantum interaction between systems A and B. 

Given the many applications of entanglement, it is clearly important to be able to decide if 
a particular bipartite state is separable or entangled. When the state is specified as the rational 
entries of a density matrix acting on a finite-dimensional Hilbert space % — Ha ®T~Lbi one can 
formulate several variations of the problem, all of them being known collectively as the quantum 
separability problem, and characterize their computational complexity |Gur03[ IGhalOj IBCYllb] . 
(See Ref. [Ioa07] for a useful, though now somewhat outdated review.) Gurvits proved that it is 
NP-hard to decide if a state pab G 5 or if 

min \\pab ~ &ab\\ 2 > e , 

where \\A\\ 2 = y^TrjAtA} is the Hilbert-Schmidt norm and e is some positive number larger than 
an inverse exponential in dim {%). Gharibian later improved upon this result by showing that this 
formulation of the quantum separability problem is strongly NP-hard — it is still NP-hard even if 
e is promised to be larger than an inverse polynomial in dim( / H). Brandao, Christandl, and Yard 
then offered a quasi-polynomial time algorithm that decides the quantum separability problem if 
it is promised that e is a positive constant [BCY llb]. by appealing to their Pinsker-inequality- 
like lower bound on the squashed entanglement [BCYlla] and to the fc-extendibility separability 
test of Doherty et al. [DPSQ21 IDPS 04]. (These concepts are defined later in our paper.) They 
also considered a variant of the promise problem where the Hilbert-Schmidt distance is replaced 
by the one-way LOCC distance [MWW09], which characterizes the distinguishability of pab and 
S if Alice and Bob are allowed to perform local operations and to send one message of classical 
communication (from either Alice to Bob or Bob to Alice). 
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Figure 1: A unitary circuit which generates a bipartite state pab on systems A and B. The qubits 
in the reference system R are traced out. 



In the circuit model of quantum computation, quantum states are generated by unitary circuits 
acting on some number of qubits (with some of them being traced out in the mixed-state circuit 
model [AKN98J), and we measure the complexity of a quantum computation by how the circuit size 
(number of gates and wires) scales with the length of the input |Wat09a| . (Note that if the circuit 
size is polynomial in the input length, then the number of qubits on which the circuit acts is likewise 
polynomial in the input length.) Thus, from the perspective of quantum computational complexity 
theory [Wat09a], one might consider the prior formulations of the quantum separability problem 
to be somewhat restrictive. The reason is the same as that given in [Ros09j: the mathematical 
description of a bipartite quantum state is polynomial in the dimension of the Hilbert space, but this 
Hilbert space is exponential in the number of qubits in the state. Thus, the matrix representation 
is exponentially larger than it needs to be when we are in the setting of the circuit model of 
quantum computation. Also, the circuit model is natural physically, as the evolution induced by a 
time- varying two-body Hamiltonian can be efficiently described by a quantum circuit |BACS 07j . 

With this dual computational and physical motivation in mind, we take an approach to the 
quantum separability problem along the above lines. We suppose that we are given a description of 
a quantum circuit of polynomial size as a sequence of quantum gates chosen from some finite gate 
set, and the circuit acts on a number of qubits, each in the state |0). As part of the description, 
the qubits are divided into three sets: a set of reference system qubits which are traced out, a set 
of qubits which belongs to Alice, and another set which belongs to Bob. Figure [I] depicts such a 
circuit. We also impose the following promise regarding the state pab generated by the circuit: 
there is either some state in the set of separable states which is ^i-close to pab in the trace distance: 

min \\pab ~ <tab\\i < £1, (3) 

or every state in this set is at least ^2-away from pab in the one-way LOCC distance: 

min \\pab ~ ^ab||i_ LO cc > E ^ ( 4 ) 

and the difference £2 — £1 is larger than a sufficiently large inverse polynomial in the circuit size. 
The reason for the asymmetric choice of norms will become clear later in the article, but for the 
moment we will simply note that the problem is well-defined: the two sets identified by Q and 
^ do not overlap because ||*||i_ LO cc ^ II* 111 (MWW09] . Let QSEP-CIRCUIT(£i, e 2 ) denote this 
promise problem, and we will also refer to it throughout this paper as both QSEP-CIRCUIT and 
the quantum separability problem. 



3 



Quantum interactive proof systems |Wat03[ IKWOOj IWat09aj provide a natural framework for 
analyzing QSEP-CIRCUIT. The idea is that a verifier, who has access to a polynomial-time bounded 
quantum computer, can exchange quantum messages with a prover, who has access to a compu- 
tationally unbounded quantum computer, in order to be convinced by the prover of the truth of 
some statement. Crucial in this setting are the notions of interaction and verification: in the case 
of a positive instance of a problem, there exists some strategy by which the prover can convince 
the verifier to accept with high probability, whereas in the case of a negative instance, with high 
probability, there is nothing that the prover can do to convince the verifier to accept. One appeal 
of the quantum setting is that it is in some ways conceptually simpler than its classical counter- 
part, thanks to Kitaev and Watrous' demonstration that it is possible to parallelize any quantum 
interactive proof system to at most three messages between the verifier and prover [KWOO]. Their 
result leaves just four natural complexity classes derived from quantum interactive proof systems 
with a single prover: 

• QIP(3)=QIP — the full power of quantum interactive proof systems (known to be equivalent 
to PSPACE [JJUWIOQ , 

• QIP(2) — there are two messages exchanged (verifler-to-prover followed by prover-to- verifier) , 

• QIP(l) — the prover sends a quantum state to the verifier (this class is more commonly known 
as QMA), 

• QIP(O) — the verifier proceeds on his own (this is equivalent to BQP, the class of problems 
efficiently decidable on a quantum computer with bounded error). 

It has been remarked that QIP(2) appears to be the "most mysterious" of these complexity 
classes [JUW09J. At the very least, not much is known about it. 

2 Overview of Results 

In this paper, we contribute the following results: 

• QSEP-CIRCUIT is decidable by a two-message quantum interactive proof system for a wide 
range of parameters. The proof system builds upon the approach of Brandao et al. |BCYllb] 
and the notion of fc-extendibility [DPS02, DPS04]. In particular, the verifier generates the 
state pab using its description as a quantum circuit and then sends the reference system to the 
prover. In the case of a positive instance, the state is separable (or close to it), and the prover 
can generate a purification of a fc-extension of the state by acting with a unitary operation on 
the reference system and some ancilla qubits. The prover sends all of his output qubits back 
to the verifier, who then performs phase estimation over the symmetric group [Kit95] (also 
known as the "permutation test" [B BD + 97l IKNY 08]) in order to verify whether the state 
sent by the prover is a fc-extension. This proof system has completeness and soundness error 
directly related to e\ in ^ and 82 in ([I]). 

• QSEP-CIRCUIT is hard for the class of promise problems decidable by a quantum statisti- 
cal zero-knowledge (QSZK) proof system [Wat02 ; Wat09bj. A QSZK proof system is similar 
to a quantum interactive proof system, with the exception that in the case of a positive 
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instance of the problem, the verifier should be able to generate the state on his systems 
with a polynomial-time quantum computer (so that he has not generated any state which 
he could have not have generated already on his own)j^] We prove this result by a reduc- 
tion from the QSZK-complete promise problem QUANTUM-STATE-DISTINGUISH ABILITY to 
QSEP-CIRCUIT. This reduction is somewhat similar to a previous reduction of Rosgen and 
Watrous [RW05J , but the setting here is different and thus requires a different analysis (though 
interestingly, the analysis is reminiscent of arguments used in quantum information theory 
|ADHW09llD^v05] ). 

• QSEP-CIRCUIT is NP-hard. This result follows from the fact that the matrix version of the 
quantum separability problem is NP-hard, though we require some results of Knill which 
show that one can encode a quantum state efficiently by a unitary circuit if given a matrix 
description of the state [Kni95]. 

• We consider a variation of QSEP-CIRCUIT, called QSEP-CHANNEL, in which some of the 
inputs to the circuit are arbitrary and some are fixed in the state |0). The output qubits 
are again divided into three sets: the reference system qubits which are traced out, Alice's 
qubits, and Bob's qubits. We can think of this circuit as a quantum channel Ms^ab with an 
input system S and two output systems A and B. The task is then to decide if there exists 
an input to the circuit such that the output state shared between Alice and Bob is separable, 
and we have the promise that either 

min \\M S ^AB (ps) ~ <tab\\i < £l, 

or 

min \\Ns^ab (ps) ~ ^ab||i_ LO cc ^ e ^ 

PS, VAB^S 

where again the difference £2 — £1 is larger than a sufficiently large inverse polynomial in 
the circuit size. We show that this promise problem is Q IP-complete. The reasoning here 
is similar to the reasoning for our earlier results for QSEP-CIRCUIT, and we again exploit 
the results of Rosgen and Watrous |RW05| (in particular, the fact that QUANTUM-CIRCUIT- 
DISTINGUISH ABILITY is Q IP-complete). We will also refer to this promise problem through- 
out as the channel quantum separability problem. 

• MULTI-QSEP-CIRCUIT, a multipartite generalization of QSEP-CIRCUIT, is also decidable by a 
two-message quantum interactive proof system for a wide range of parameters. The analysis of 
the proof system exploits a recent quantum de Finetti theorem of Brandao and Harrow |BH12j 
along with the analysis used in the proof system for QSEP-CIRCUIT. MULTI-QSEP-CIRCUIT 
is also NP- and QSZK-hard because QSEP-CIRCUIT trivially reduces to it, as QSEP-CIRCUIT 
is merely a special case of MULTI-QSEP-CIRCUIT. 

The paper is structured as follows. In the next section, we introduce preliminary concepts 
such as quantum states and channels, distance measures between quantum states, fc-extendibility, 
three- and two-message quantum interactive proof systems and complete promise problems for their 
corresponding complexity classes. Section [4] contains our first result, in which we demonstrate that 

x This is the definition of QSZK in the case when the verifier behaves honestly. Watrous later showed that the 
expressive power of this class is the same as the case in which the verifier does not behave honestly Wat09b . 
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a two-message quantum interactive proof system decides QSEP-CIRCUIT. We show in Section [5] 
that QSEP-CIRCUIT is hard for the class QSZK, and in Section |6j we show that it is NP-hard as 
well. In Section [7J we extend the above results to show that the channel variation of the quantum 
separability problem is Q IP-complete. Section [8] gives a two- message quantum interactive proof 
system that decides MULTI-QSEP-CIRCUIT. Finally, we conclude in Section [9] with a summary and 
some open directions. 



3 Preliminaries 

In this preliminary section, we review background concepts from quantum information theory 
[NCOOj and quantum computational complexity theory [Wat09a]. 



3.1 Quantum states and channels 

A quantum state is a positive semideflnite, unit-trace operator (referred to as the density operator) 
acting on some Hilbert space %. Let V(H) denote the set of density operators acting on a Hilbert 
space %. An extension of a quantum state p E T>(Ha) is some state uj E T>(Ha ®T~Lb) (on a 
larger Hilbert space) such that p = Tr^ B {oj}. A quantum state is pure if its density operator 
is unit rank, in which case it has an equivalent representation as a unit vector E %. A 
purification of a density operator p E V(T~L) is a pure extension of p. Throughout this work, 
we restrict ourselves to finite-dimensional Hilbert spaces, so that a d-dimensional Hilbert space is 
isomorphic to C d . A quantum channel is a linear, completely positive, trace-preserving (CPTP) 
map J\f : T>(H[ n ) — >► T>(H out ). The Stinespring representation theorem states that every CPTP map 
can be realized by tensoring its input with an ancillary environment system in some fiducial state 
|0)^ E %e where dim (%e) < dim( / Hi n ) dim( / H out ), performing some unitary operation on the joint 
Hilbert space l~L in factoring the unitary 's output Hilbert space as H nt ® He', and finally 

tracing over the Hilbert space %e' |Sti55| . That is, for every CPTP map A/", there exists some 
unitary U such that the following relation holds for all p E V(Hm)' 

Ar(j>) = Tr E ,{u(p®\0) (Oyc/t}. 

This theorem is the essential reason for the equivalence in computational power between the unitary 
and mixed-state circuit models of quantum computation [AKN98]. 



3.2 Distance measures 

The trace norm of an operator A is H-A^ = Tr{vC4l\A}. The metric on quantum states induced 
by the trace norm is called the trace distance, which has an operational interpretation as the bias 
when using an optimal measurement to distinguish two quantum states p and a [NCOOj. That is, 
when p and a are chosen uniformly at random, the probability p SUC c of successfully discriminating 
them with an optimal measurement is as follows: 

Psucc = ^ ( 1 + \ IIp-^IIi) • 

There is also a variational characterization of the trace distance as 

\\p — =2 max Tr{A(p — a)}, 

" Mi 0<A<7 
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which leads to the following useful inequality that holds for all F such that < T < I: 

Tr {I>} > Tr {Taj - \\p - a\\ x . (5) 

Suppose now that pab and gab are in V (T~La ®T~Lb)- Then the one-way local operations and 
classical communication (1-LOCC) distance between these two states, induced by a 1-LOCC norm 
|MWW09j . is given by 

Wpab ~ ctab||i_ LO cc = max \\(I A ® A B ^x) (pab - °ab)\\i , 
where the maximization on the RHS is over all quantum-to-classical channels 

with A x > for all x E X, J2 x ex A x — I, and {\x)} some orthonormal basis. (Note that we could 
also define the 1-LOCC distance with respect to measurement maps on Alice's system, which gives 
a value generally different from the above.) The 1-LOCC distance is equal to the bias in success 
probability when using an optimal one-way LOCC protocol to distinguish the states: 



Psucc,l-LOCC = ^ y 1 + g " PAB ~ ° AB " i-LOCC 

This distance is the natural distance measure in the setting of Bell experiments [Bel64j or quantum 
teleportation, for example. Also, it follows that 

Hp-^IIi-locc < IIp-^IIu ( 6 ) 

because a general protocol to distinguish p from a never performs worse than one restricted to 
one-way LOCC operations. 

The quantum fidelity F (p, a) between two quantum states p and a is another measure of 
distinguishability, defined as follows: 

F(p, a) = 11^^111 (7) 

Uhlmann characterized the fidelity as the optimal squared overlap between any two purifications 
of p and a [ Uhi76j : 

F(p,<j) = max K^pK) I 2 - 
I<M,I<M 

Thus, the fidelity has an operational interpretation as the optimal probability with which a purifi- 
cation of p would pass a test for being a purification of a. Since all purifications are related by a 
unitary operation on the purifying system, this characterization is equivalent to the following one: 

F(p,<j) = nmx\(cf> p \(U®lH)\(i>*)\ 2 , (8) 

where \<j) p ) and \(j) a ) are now two fixed purifications of p and a, respectively, and the optimization 
is over all unitaries acting on the purifying system (the fact that Q is equal to ([§]) is often referred 
to as Uhlmann's theorem). The fidelity and trace distance are related by the Fuchs-van-de-Graaf 
inequalities |FvdG99j : 

l-y/F(p,a) < | Ib-o-lli < ^l-F( Pl a). (9) 
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3.3 Separability, fc-extendibility, and the maximum fc-extendible fidelity 

A bipartite state pab £ ^ (Ha® He) is fc-extendible [DPS021 DPS04J if there exists a state 
(^AB 1 --B k € 2? ® ® • • • ® ^Bfc) such tri at 

1. Each Hilbert space is isomorphic to H B for all z E {1, . . . , fe}. 

2. The state 0JAB 1 ---B k is invariant under permutations of the systems B\ through That is, 

WeS k : uj ABv .. Bk = (I A ® W% v .. Bh ) u ABl ...B k (Ia ® W^-sJ 1 , (10) 

where is the symmetric group on k elements and W Bl , mmB is a unitary operation that 
implements the permutation tv of the B systems. 

3. The state oo ABl ---B k is an extension of pab- 

Pab = Tr B2 ... Bk {uj ABl -B k } ■ 

Let Sk denote the set of fc-extendible states. Every separable state is fc-extendible for all k > 2. 
Since every separable state has a decomposition of the form in Q, an obvious choice for a k- 
extension is 

(x) \<lp x ) (lp x \ A ® \<j) x ) (<j> x \ Bl ®-~®\<l>x) (<l>x\ Bk • (11) 

On the other hand, if a state is not separable, there always exists some k for which the state is not 
fc-extendible, and furthermore, for every / > fc, the state is also not /-extendible [DPS02| |DPS04| . In 
this sense, the set £ k forms an approximation to the set S of separable states, and the approximation 
becomes exact in the limit as k oo. 

The maximum k-extendible fidelity of a state pab is defined as 

max F(p AB ,a AB ). 

O AB^k 

In this paper, we give the maximum fc-extendible fidelity an operational interpretation as an upper 
bound on the maximum probability with which a prover can convince a verifier to accept in our 
QIP(2) protocol that tests for fc-extendibility. Clearly, the above quantity converges to the maximum 
separable fidelity (defined in [Wat04j) in the limit as k oo: 

max F (pab, °ab) Hm max F (pab, °ab) • 

(JAB^S k^OO (TAB^k 

Finally, we state a lemma which extends Theorem 3 of |BCYllb] . This lemma establishes a 
notion of approximate fc-extendibility which is essential for our work here. The proof of this lemma 
is a straightforward modification of the proof of Theorem 3 of |BCYllb] and we provide it in the 
appendix. 

Lemma 1 Let pab be e-away in one-way LOCC distance from the set of separable states, for some 
e > 0; 

min \\pab ~ °ab\\ulocc ^ e - 
vab£& 
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Figure 2: Quantum interactive proof systems with (a) three messages and (b) two messages ex- 
changed between the verifier and the prover. 



Then the state pab is S-away in trace distance from the set of k-extendible states: 

min \\p AB - <tab\\i > 8, 

for 5 < e and where 

[ 16 In 2 log|A| " 
k ~ (e - 5f ' 

3.4 Quantum interactive proof systems 

Quantum interactive proof systems were first defined and analyzed in [Wat02 ; KW00]. Their study 
is an important component of quantum computational complexity theory, and they are essential 
in our work here. A quantum interactive proof system involves an exchange of quantum messages 
between a polynomial-time quantum verifier and a computationally unbounded quantum prover. 
Since any quantum interactive proof system can be parallelized such that at most three messages 
are exchanged between the verifier and prover (QIP = QIP(3) up to a wide range of parameters) 
[KWOOj , we focus our attention on quantum interactive proof systems with three or fewer messages, 
starting by defining QIP(3). 

3.4.1 Three-message quantum interactive proof systems 

Given an input string x of length n, a quantum verifier consists of two unitary quantum circuits 
V\ and V2 computed from x in polynomial time. These circuits are generated from some finite 
gate set that is universal for quantum computation |NC00j IWat09aj . The qubits of the verifier 
are divided into two sets: private qubits and message qubits. The verifier exchanges the message 
qubits with the prover, while keeping the private qubits in his own laboratory. A quantum prover 
is defined similarly to the verifier — he has private qubits and message qubits that he exchanges 
with the verifier. However, he is allowed to perform two arbitrary, unconstrained unitary quantum 
operations Pi and P2 on the qubits in his laboratory. 

Figure [2^ a) depicts a quantum interactive proof system with three messages. P is the register 
containing the prover's private qubits, M contains the message qubits, and V contains the verifier's 
private qubits. For simplicity, we take the convention that these registers may change size through- 
out the execution of the protocol, as long as registers M and V are polynomial in the length of 
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the input x. The quantum interactive proof system begins with the prover initializing the qubits 
in his registers P and M to the all-zero state, and the verifier does the same to his qubits in the 
register V. The prover then acts with the unitary Pi on registers P and M and sends the message 
qubits to the verifier. They proceed along the lines indicated in Figure [2^a), until the verifier acts 
with a final unitary V2. This final unitary has two output systems: a decision qubit in register D 
and other "garbage qubits" in register G. The verifier then measures the decision qubit in the 
computational basis to decide whether to accept or reject. The maximum probability with which 
the prover can make the verifier accept is equal to 

max \\{l\ D V 2 P 2 V 1 \^) PM \Q) v \\l, (12) 

where the maximization is over all pure states |V ? )pm — ^1 I^)pm the prover can prepare at 
the beginning of the protocol and all unitaries P2 that he can perform. 

By defining A/*i as the quantum channel induced by applying the verifier's first unitary and 
tracing over the verifier's message register M: 

M (p) = Tr M {Vi (p ® |0) <0| y ) V}} , 

defining A/2 as the quantum channel induced by applying the inverse of the verifier's final unitary 
and tracing over the verifier's message register M: 

M 2 (a) = Tt m {vl (<7 G ® |1) (1| D ) V 2 } , (13) 



and applying Uhlmann's theorem in &8h to the maximum acceptance probability in (12), one can 



rewrite (12) as the maximum output fidelity of the channels J\f\ and A2 over all possible inputs to 



them |KW00l[RW05llRos09j : 

max ||(l| D y 2 P 2 y 1 |^) PM |0) y ||^maxF(M(p),AA 2 (a)). (14) 

(See Chapter 4 of |Ros09j for details of this calculation). 
We can now define the complexity class QIP(3): 

Definition 2 (QIP(3)) Let A = (A yesi A no ) be a promise problem, and let c, 5 : N —> [0,1] be 
polynomial-time computable functions such that the gap c — s is at least an inverse polynomial in 
the input size. Then A E (?/P(3, c, s) if there exists a three-message quantum interactive proof 
system with the following properties: 

1. Completeness: For all input strings x E A yes , there exists a prover that causes the verifier to 
accept with probability at least c(\x\). 

2. Soundness: For all input strings x E A no , every prover causes the verifier to accept with 
probability at most s(\x\). 

Note that one can amplify the gap between c and s to a constant by employing parallel repetition 
jKWOOj . 

Given the fact that we can rewrite the maximum acceptance probability of any QIP(3) protocol 



as in (14), it is straightforward to formulate a complete promise problem for QIP(3) called CLOSE- 



IMAGES, which essentially just amounts to rewriting the above definition |RW05j lR o s09j : 
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Problem 3 (CLOSE-IMAGES) Fix two constants c, s E [0,1] such that c > s. Given are two 
mixed-state quantum circuits Qo and Q\, each accepting n-qubit inputs and having m-qubit outputs. 
Decide whether 

1. Yes: There exist n-qubit states po and p\ such that max /)0;Pl F (Qo (po) ? Qi (pi)) > c - 

Afo; For all n-qubit states po and pi, it holds that max p0)Pl F (Qo (po) , Q\ (pi)) < s. 

The following promise problem is also complete for QIP(3), but proving so requires more than 
a trivial rewriting of the definition of QIP(3) |RW05t lRos09| : 

Problem 4 (QUANTUM-CIRCUIT-DISTINGUISHABILITY) Fix a constants e [0,1). Given 
are two mixed-state quantum circuits Qo and Q\, each with n-qubit inputs and m-qubit outputs. 
Decide whether 

1. Yes: There is a quantum input for which the circuits are distinguishable: 

max \\(I R ® Qo) (p) - (Ir ® Qi) (p)Hi > 2 - s. 

peV(H R ®Hin) 

2. No: No quantum input can distinguish the circuits: 

J( J * ®Qo)(p)-(Ir®Qi)(p) 111 <£• 

peV(H R ®H tn ) 

In what follows, we abbreviate QUANTUM-CIRCUIT-DISTINGUISHABILITY as QCD. 
3.4.2 Two-message quantum interactive proof systems 

Now that we have defined three-message quantum interactive proof systems, it is straightforward 
to define two-message quantum interactive proof systems. The description is essentially identical 
to that given in the first two paragraphs of the previous section, with the exception that the verifier 
acts both first and last with unitaries V\ and V2, while the prover acts between these two operations 
with a unitary P\ (see Figure [2^a)). Thus, the maximum probability with which the prover can 
make the verifier accept is equal to 

max||(l| D y 2 P 2 |0} P |</)} My ||^ 

where \<j)) MV — V\ |0) M y. By following essentially the same reasoning as before, we can rewrite 
this maximum acceptance probability in terms of the quantum fidelity. First, we define the mixed 
state 

uj v = Tr M {vi |0)(0| My V}}. 

We also define the quantum channel J\f from V2 as in ( fl3| ). By again applying Uhlmann's theorem, 
it is straightforward to prove that the maximum acceptance probability is equal to the fidelity 
between the state uo and the channel J\f when maximizing over all inputs to the channel: 

max||(l| D V 2 P 2 |0) P \<t>) MV \\ 2 2 = max F (lj, M {a)) . (15) 

The definition of the complexity class QIP(2) is identical to that given in Definition [2] (but substi- 
tuting QIP(2) for QIP(3)). One can similarly amplify the gap between c and s to a constant by 
employing parallel repetition | JUW09j . Also, the following promise problem, called CLOSE-IMAGE, 
is a complete promise problem for QIP(2): 
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Problem 5 (CLOSE-IMAGE) Fix two constants c, s E [0,1] such that c > s. Given is a mixed- 
state quantum circuit to generate the m-qubit state po and a mixed-state quantum circuit Q\, with 
an n-qubit input state and an m-qubit output state. Decide whether 

1. Yes: There exists an n-qubit state pi such that max pi F (po, Q\ (pi)) > c. 

2. No: For all n-qubit states p\, it holds that max pi F (po, Qi (pi)) < s. 

The fact that CLOSE-IMAGE is complete for QIP(2) follows essentially the same reasoning as in 
|Ros09| (it amounts to a rewriting of the definition of QIP(2)). 

3.4.3 Quantum statistical zero-knowledge proof systems 

Another kind of quantum interactive proof system that is relevant for our work here is a quantum 
statistical zero- knowledge (QSZK) proof system [Wat02 ; Wat09bj. The definit ion of the "honest- 
verifier" version of this complexity class is essentially the same as that for QIP (with an arbitrary 
number of messages exchanged), but the difference is that in the case of a positive problem instance, 
the states of the verifier before and after every interaction with the prover should be such that he 
could have actually generated them himself. In this sense, he does not gain any "knowledge" 
by interacting with the prover (other than being convinced to accept). Watrous has shown that 
any honest- verifier QSZK proof system has an equivalent proof system in which the verifier is not 
required to behave honestly [Wat 09b]. 

The following promise problem is complete for QSZK [Wat02j: 

Problem 6 (QUANTUM-STATE-DISTINGUISH ABILITY) Fix a constants e [0,1). Given is 
a mixed-state quantum circuit to generate the n-qubit states po and p\. Decide whether 

1. Yes: ||po — p\\\ 1 > 2 — e. 

2. No: ||po -Pilli < e. 

In what follows, we abbreviate QUANTUM-STATE-DISTINGUISH ABILITY as QSD. 

4 A two-message quantum interactive proof system decides the 
quantum separability problem 

We are now ready to provide a formal statement of the promise problem QSEP-CIRCUIT, and we 
follow with a proof that it is decidable by a two-message quantum interactive proof system. 

Problem 7 (QSEP-CIRCUIT(5 C , S s )) Given is a mixed-state quantum circuit to generate the n- 
qubit state pab, along with a labeling of the qubits in the reference system R and the output qubits 
for A and B. Decide whether 

1. Yes: There is a separable state gab £ S that is 5 c -close to pab in trace distance: 

min \\pab ~ °Ab\\i < S c . 
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Figure 3: A two- message quantum interactive proof system for QSEP-CIRCUIT. It begins with the 
verifier executing the circuit U p that generates the state pab- He sends the reference system to the 
prover. In the case that pab is separable, the prover should be able to act with a unitary on the 
reference system and some ancillas in order to generate a purification of a fc-extension of pab- The 
prover sends all of the extension systems back to the verifier, who then performs phase estimation 
over the symmetric group (a quantum Fourier transform followed by a controlled permutation) in 
order to test if the state sent by the prover is really a fc-extension. 



2. No: Every separable state is at least 8 s - far from pab in 1-LOCC distance: 

min \\pab ~ °Ab\\i- LO cc ^ s s- 

Theorem 8 QSEP-CIRCUIT(5 C , 5 S ) E QIP(2) if there are polynomial-time computable functions 
5 C , 8 S : N — >> [0, 1], such that the difference 6^/8 — 2\f5~ c is larger than an inverse polynomial in the 
circuit size. 

Proof. Figure [3] depicts a two-message quantum interactive proof system for QSEP-CIRCUIT. The 
protocol begins with the verifier preparing the state \^p) R ab^ a particular purification of pab, by 
running the quantum circuit U p specified by the input string (the problem instance). The verifier 
transmits the reference system to the prover, who then acts on R and some ancillary qubits with a 
unitary P\ that has output systems i?', £>2, • • • , B^. The prover transmits systems £?2, • • • •> B^ to 
the verifier. The verifier then performs phase estimation over the symmetric group [Kit 95 , BB D+97] 
(also known as the "permutation test" |KNYQ8| ) on the registers £>, £>2, • • • , B^, using the qubits 
in system C as the control. The verifier performs a computational basis measurement on all of the 
qubits in the control register C and accepts if and only if the measurement outcomes are all zeros. 

This protocol is just an implementation of a fc-extendibility test on a quantum computer. We 
can build intuition for why it works on YES instances by examining the exact case, when pab is 
actually a separable state. In this case, we know that pab has a decomposition of the form given 
in Q, and as such, it has an extension of the form in (11) for all k > 1. Thus, the following state 
is a purification of pab- 

\ ( t } k,p) RfA BB 2 ...B k = ^ PX ( X ) \ X )r' ® \<I>x)b ® \<I>x)b 2 \<l>x) B k > 
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where is some orthonormal basis for the reference system. Since all purifications are related 

by unitaries on the reference system, the prover can append ancilla qubits to the R system received 
from the verifier and perform a unitary P\ that takes \^ p ) R a B |0) to l^k^p) R /^ BB2 ... Bk - The prover 
then sends the systems £>2, • • • , to the verifier. The verifier performs a permutation test on the 
systems £>, £>2, B^. Since the state \4 > k,p)n/ABB 2 -~B k * s mvai> i an t under permutations of the 
systems £>, £>2, . . . , the qubits in the control register C do not acquire a phase. Thus, after the 
final quantum Fourier transform is applied, the qubits in the control register C are in the all-zero 
state with certainty. 

The analysis for a YES instance follows the above intuition closely. In this case, there is some 
state (jab £ S that is 5 c -close in trace distance to pab- By Uhlmann's theorem in Q and the 
Fuchs-van-de-Graaf inequalities in Q, there is a purification \^a) rab °f a AB such that 

IW ^p\rab - I^M (^\rab\\i < 2 V$~c- (16) 
So the prover can just operate as above, but choosing his unitary Pi to correspond to the state 
\^o-)rab instead. Writing as U the unitary corresponding to P\ followed by the permutation test, 
we obtain the following lower bound on the probability with which the verifier accepts: 

Tr{|0) <0| c [/(|Y>p> (il> P \ RAB )tf) 
= Tr{c/t| ) (0\ C U(^ P ) (*P p \rab)} 

> Tr {f/t |o) (0\ C U(\^) m RAB )} - WpIrab ~ |^> (^IrabU 
>\-2y/8 e , (17) 

where the first inequality follows from ([5]), and the second inequality follows by applying (16) and 
because the protocol accepts with probability one for a separable state. 
The analysis for a NO instance has two components: 

1. demonstrating that the maximum fc-extendible fidelity is an upper bound on the maximum 
acceptance probability 

2. using Lemma [l] regarding approximate fc-extendibility and the first item above to specify 
how large k should be in order to obtain a good upper bound on the maximum acceptance 
probability^] 



We now discuss the first item above. Recall from (15) that the maximum acceptance probability 
of any QIP(2) system is equal to the maximum fidelity between the state generated by the verifier's 
first circuit and the channel generated by the inverse of the verifier's second circuit. For the protocol 
in Figure |3j the state generated by the verifier's first circuit is as follows: 

Pab ® |perm) (perm| c , 

where Iperm)^ is a superposition over all possible permutations of k elements resulting from an 
application of the quantum Fourier transform |NC00| to the state \0) c : 

|perm) c = Wo ( 18 ) 



2 For a YES instance, the value of k does not matter because the lower bound on the maximum acceptance 
probability is always as given above. 
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so that the C register requires |~log 2 (fc!)] qubits. (Note that Figure [5] depicts the verifier generating 
Iperm)^ later in the protocol, but we could just as easily reorder things so that he generates this 
state in the first step.) The channel generated by the inverse of the verifier's circuit conditional on 
accepting is 



M A BB 2 -..B k ^ABC (<TABB 2 -B k ) = ^B 2 -B k j (Uu) B B 2 -B k C (°ABB 2 -B k ® |perm) (perm| c ) (yQ 
where (Un) BB2 ... Bk c ls a controlled-permutation operation: 



bb 2 -b 



(Uu) BB2 ... BkC = E W BB 2 -B k ® K) He > (19) 
ireS k 



and W BB2 , mmB is a unitary operation corresponding to permutation tv (mentioned before in (10)). 
So the maximum acceptance probability is equal to 



max F (pab ® |perm) (perm| c , MABB 2 -B k ^ABC (°ABB 2 -B k )) • 



°ABB_ 

Since the fidelity can only increase under the discarding of the control register Cj^jthe maximum 
acceptance probability is upper bounded by the following quantity: 

max F (pab, Mabb 2 -b^ab (<?ABB 2 -B k )) , (20) 

&ABB 2 ---B k 

where 

MABB 2 -B k ^AB (°ABB 2 -B k ) = Trc {M ABB 2 -B k ^ABC (° ABB 2 -B k )} 

= TT B2-B k {(IA ® W% B2 ... Bk ) *ABB 2 ...B k (l A ® W j g B2 ... Bfc ) t } , 

which is just the channel that applies a random permutation of the B systems and discards the 
last k — 1 systems £>2, • • • , B^. Clearly, since the channel M>ABB 2 -B k ^AB symmetrizes the state of 
the systems BB2 • • • B^, the maximum in (20) is achieved by a state (JABB 2 ---B k for which systems 
BB2 - — Bk are permutation symmetric. Thus, by recalling the definition of fc-extendibility, we can 
rewrite (20) as the maximum fc-extendible fidelity of pab- 

max F (pab, Mabb 2 -b^ab (vABB 2 -B k )) = max F (pab, °ab) • (21) 

O ABB 2 -B k CTAB^Zk 

This demonstrates that the maximum fc-extendible fidelity is an upper bound on the maximum 
acceptance probability and completes our proof of the first item above. 

The second part of the analysis of a NO instance involves determining how large k needs to be. 
Suppose that 

min \\pab ~ ^ab||i_ L occ ^ 



3 We can interpret discarding the control register as actually giving it to the prover, so that the resulting fidelity 
corresponds to the maximum acceptance probability in a modified protocol in which the prover controls the inputs 
to C. 
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According to Lemma [TJ if we take k to be larger than 



16 In 2 \og\A\ 



then we can guarantee that 



mm 



\PAB - &Ab\\i > 8's- 



for S f s strictly less than S s . We can enforce this latter condition by setting 5' s = 5 s /y/2. Observe 
that k is polynomial in ua, where via is the number of qubits in Alice's system. Then using the 
following manipulation of the Fuchs-van-de-Graaf inequalities in Q: 



we have that 



F(p,a)<l--\\p-a\ 



1 



l ? 



max F (pAB, °ab) < 1 - 7 min \\p AB - (J A b\\\ (22) 

< 1 - \ (Kf (23) 
= 1 - S 2 s /8 (24) 

In the above, we have separated the probability of accepting and the probability of rejecting 
by an inverse polynomial in via (namely, from the promise that the difference 5 2 s /8 — 2\f8~ c is at 
least an inverse polynomial in the circuit size), and it is known that an inverse polynomial gap is 
sufficient to place this protocol in QIP(2) (see Section 3.2 of Ref. [JUW09] for how to amplify an 
inverse polynomial gap). Thus, we have given a two-message quantum interactive proof system 
that decides the quantum separability problem. ■ 

If one considers the characterization of QIP(2) in terms of the complete promise problem CLOSE- 
IMAGE, one has to identify a state and a channel to compare by means of the fidelity maximized 
over all inputs to the channel. The natural state to consider for QSEP-CIRCUIT is pab, while the 
natural channel to test for fc-extendibility is one that applies a random permutation to the systems 
£>, £>2, Bk of a state <JABB 2 ---B k and traces out the systems £>2, B^. The Stinespring 
dilation of the channel is the circuit for phase estimation over the symmetric group, so that in this 
sense, we can say that CLOSE-IMAGE finds the phase estimation circuit given in Figure [3j 

Also, from the above proof, it is clear that if the promise regarding QSEP-CIRCUIT is given 
in terms of fidelities rather than the trace distance and the 1-LOCC distance, then the promise 
concerning the gap between 8 S and 6 C could be that their difference is larger than an inverse 
polynomial (rather than making a promise about the difference 5^/8 — 2\f5~ c ). 



5 QSZK-hardness of the quantum separability problem 

Having placed an upper bound on the difficulty of solving QSEP-CIRCUIT, we now move on to lower 
bounds, beginning in this section with a proof that it is hard for QSZK. Our approach is to exhibit 
a Karp reduction from the QSZK-complete promise problem QSD to QSEP-CIRCUIT. The essential 
idea behind the reduction is similar to Rosgen and Watrous's reduction of CLOSE-IMAGES to QCD 

[RWQ5URosQ9j . 



16 




Figure 4: Given respective circuit descriptions U po and U P1 for generating the states po and p\ 
on the output system 5, one can compute a description for the above circuit in polynomial time, 
and furthermore, the above circuit can be run efficiently on a quantum computer. This serves 
as a reduction from QUANTUM-STATE-DISTINGUISH ABILITY to QSEP-CIRCUIT, i.e., where one 
should decide if the state on systems A and BR is separable with respect to this cut. 



In order to demonstrate this reduction, we have to show that there is a polynomial-time algo- 
rithm that encodes YES instances of QSD into YES instances of QSEP-CIRCUIT and the same for 
the NO instances. Recall that for QSD, we are given a description of circuits U po and U P1 that 
generate mixed states po and p\. The output qubits of the circuit are divided into two sets: qubits 
in a reference system R that are traced over and qubits in a system S which contains pi. For 
i e {0,1}, let 

so that 

Pi = r ^R{\^ P i)(^Pi\ RS }' 

Figure [4] depicts a circuit that accomplishes the reduction. From the description of the circuits 
U P0 and U P1 , one can generate a description of the circuit in Figure [4] in polynomial time, and 
furthermore, the resulting circuit runs efficiently on a quantum computer [Ros09]. The circuit 
takes as input a Bell state 

1*"%* = ^ (|oo> ab + |ii> ab ), 

and performs the following controlled unitary from the qubit B to the ancilla qubits: 

|o> (o| B ®c/ Po + |i) <1| B ®CV 

The resulting state is as follows: 

W)abrs = ~y= {\°)a \°)b \^ P0 )rs + l 1 )^ |1)b \^pi)rs) ■ 
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The output qubits are divided into three sets: environment qubits in the system S that are traced 
over, a single qubit in system A, and qubits in systems BR. Thus, the state resulting from applying 
the circuit in Figure [4] is as follows: 

uj A:B r = Trs {\ip) (<p\ ABRS } • (25) 

The task is to decide whether the state on systems A and BR is separable across this cut, subject 
to the promise in Problem [7| Our claim is that YES instances of QSD map to YES instances of 
QSEP-CIRCUIT, with the same holding true for NO instances. 

The intuition for why this reduction works is as follows. In the case of a YES instance of QSD, 
the states po and p\ are approximately orthogonal, so that tracing out the S system of the circuit 
in Figure [I] decoheres the Bell state, leaving a state on A and BR close to the following state: 

"7br = \ (1°) <°U ® |o> (0| B ® (VVo) fl + |i> <iu ® |i) (1| B ® (Mr) ■ (26) 

The above state is clearly separable with respect to the bipartite cut A : BR. In the case of a NO 
instance of QSD, the states po and p\ are approximately indistinguishable, and tracing over the S 
system of the circuit in Figure [4] does little to decohere the entanglement shared between A and 
BR. Thus, Bob can perform a local unitary operation on systems B and R to distill out a pure 
Bell state shared between A and B. After this, Alice and Bob can perform a Bell experiment on 
the distilled Bell state to determine if they indeed share a Bell state. Since these two operations 
can be performed with local operations and one message of classical communication, the resulting 
state is 1-LOCC distinguishable from the set of separable states. 
We now give a formal proof to justify this reduction: 

Theorem 9 QSEP-CIRCUIT with constant promise gap is QSZK-hard. 

Proof. We first prove that the circuit in Figure [4] maps YES instances of QSD to YES instances 
of QSEP-CIRCUIT. So we begin by assuming that 

||po — Pilli > 2-6T, (27) 



and we will use this condition to show that the fidelity between w s J[? BR m ( 26 ) and the reduced state 
^a-.br in (25) is close to one. So, recall from Uhlmann's theorem in ([§]) that the fidelity between 



A B r an d ^a-.br is the maximum squared overlap between any purifications of these states. Thus, 
if we can show that the squared overlap between two particular purifications of w*^? BR and uja-.br 
is large, then this implies a lower bound on the fidelity between these two states. Consider the 
following particular purification of of^ BR . 

\ U ABB>RS) = ^ (\°)a \°)b \°)b> \^Po) RS + l 1 )^ l 1 )^ l 1 )^ \M Rs) ' 



Recall that the trace distance bound in (27) implies the existence of a two-outcome projective 
measurement {IIo,IIi} (known as a Helstrom measurement [Hel69 ; Hol72 ; Hel76]) that has the 
following success probability in discriminating po from pi if they are chosen uniformly at random: 

^Tr {IIopo} + ^Tr {U lPl } = \ (l + \ \\p - Pl \\^ 



>1-|- (28) 
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Performing the following "Helstrom isometry" 

UsLsb' = ( n o)s ® \0) B > + ( n i)s ® |1>B' 
on the 5 system of |y)^B_RS produces a particular purification of the state ua-.br'- 

Us-+SB>\<P)aBRS = "Tf \ i )A\ i )B®\j)B'®( U j)s\^Pi)RS- 
VZ <J6{0,1} 



The overlap between these purifications is 

i^ABB'RS^S-^SB' \v)aBRS 



\\ ( k \A( k \B( k \B'(MRs) [ I^A l*>B ® U>B' ® 

\fce{o,i} / \*je{o,i} 

2 2 < fc l*>B ( fc b')B' (^Pfclfl5-TB® ( n i)5l^ft)flS 

ij,fce{o,i} 

| (VvJbs 7 *® ( n i)s IV'pJhs 



BS 



2 

ie{o,i} 

= ^Tr{n p } + ^Tr{n 1/Ol } 



where the inequality follows from (28). Squaring the overlap gives the following lower bound on 
the fidelity: 

F ( uj a P br^ uj A:Br) > 1 - e, 
which imply by the Fuchs-van-de-Graaf inequalities in ^ that 

min \\u a>.br ~ °A:Br\\i < 2y^- (29) 

Thus, the circuit in Figure [4] transforms a YES instance of QSD to a YES instance of QSEP- 
CIRCUIT. We note that the above argument is reminiscent of similar ones from quantum information 
theory |Dev05j . 

We now prove that the circuit in Figure [4] transforms NO instances of QSD into NO instances 
of QSEP-CIRCUIT. In this case, we have the promise that the states po and p\ are nearly indistin- 
guishable: 

||po - pilli < 

Due to the Fuchs-van-de-Graaf inequalities, we have the following lower bound on the fidelity: 

F (po.pi) >l-e, 

and Uhlmann's theorem implies the existence of a unitary operation Ur acting on the reference 
system of \^ Pl ) RS such that 

(^po I rs U R ® T $ I^pi ) rs ^ ^ l ~ £ - 
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(A global phase can be fixed for Ur such that the overlap is a real number.) Thus, Bob can apply 
the following controlled- unitary to the state \tp) abrs'- 

C U BR=\^) <0| B ®Jfl+|l)<l| B ®l7fl, 

leading to 

(|0) (0| B ® I R + |1) (1| B ® U R ) W)abrs = 4| (IO)a |0) b \Mrs + l 1 )^ l 1 )^ ^ ® !s \Mrs) • 
Then the overlap between \& + )a B ® IV^o)^ an d the resulting state is large: 

\ (((OU <0| B + (Ma (Mb) ® ^VoIbs) (IO)a |0> b hUfis + |1)a |1)b % ® ^ I^Obs) 



1 

2 ' 2 



+ o (V'po Iftg ^fl ® ^ IVVi)flS 



1 1 /5 

> - + -VI - £ 
~22 

> vT^i, 

implying that the fidelity is larger than 1 — e. Thus, by a local operation, Bob can distill a state 
which is 2y / e-close in trace distance to the product state \& + )a B ® |Vv>o)bs : 

C U BR \<p) (<p\abrs {C% R y ~ \$ + ) ($ + \ AB ® I^po) (^oIbsI, < 2 v^- 

(We remark that the above argument is similar to a "decoupling" argument well known in quantum 
information theory |Dev05^ K"DHW09| .) 

Now, we would like to argue that the one-way LOCC distance between cja.br and the sep- 
arable state cr\. BR E S closest to uja-.br is larger than an appropriate constant, so that we 
can claim that the circuit in Figure [4] maps NO instances of QSD to NO instances of QSEP- 
CIRCUIT. In order to do so, Bob first performs the local unitary C BR . This transforms the state 

(Gbr)^ (®ab ® ( x I j po)r) Cbr to ® {^pq)r an d the separable state cr\. BR to some other separa- 
ble state (cr* A , BR ) f . Alice and Bob then perform a Bell experiment, guessing the state to be \& + )a B 
if there is a violation of a Bell inequality and guessing a separable state otherwise [Bel64] . Equiv- 
alently, Alice and Bob could proceed as in the CHSH game (a reformulation of a Bell experiment 
as a nonlocal same [CHTW04Q . In such a protocol, Alice flips a coin x and chooses one of two 
binary-outcome measurements to perform on her qubit. She sends both x and the measurement 
outcome a to Bob. Bob then flips a coin with outcome y and performs one of two binary-outcome 
measurements on his qubit, naming the measurement result b. Bob declares the state to be the 
Bell state in the case that x A y = a © b (when they "win the CHSH game") and otherwise declares 
that it is not the Bell state. It is well known that the winning probability of the CHSH game with 
a Bell state is equal to cos 2 (tt/8) ~ 0.85, while the maximum probability with which they can win 
this game with a separable state is equal to 0.75 [CHTW04] . This gives the following lower bound 
on the one-way LOCC distance between (C BF >y (&ab ® (VVo)^) ^br an< ^ a A-BR : 

(Cbb) 1 ($ab ® (Mr) Cbr ~ <T *A:B R \\ 1 _ IX)CC = Kb ® (Mr ~ (^ : bb)'|| 1 _ LO cc 

> || (cos 2 (7r/8),sin 2 (7r/8)) -(0.75,0.25)^ 

> 0.2. (30) 
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Thus, by combining with the distillation argument above, we have the following lower bound on 
the one-way LOCC distance between uja-.br and cr\. BR : 



l-LOCC 

1-LOCC 



\\UA:BR ~ ^A:Bfllll-LOCC - ( C BR^ (®AB ® (^Po)r) C BR ~ a A:BR 

~ | (C U BR ) ] (<S>\ B <g> (^ )J Cg fl - (^A:BR 

> \\$\ B <8> (^ po )^ " (<W)'||i_ LO CC 

" | (C U BR ) ] (§\ B ® (^po)*) Cg fl - ^Bfl^ 

> 0.2-2^, (31) 

where the second inequality follows from ^ and the fact that (C BR ) is a local unitary, and the 
third from ( |30| ) and the argument at the end of the previous paragraph. Thus, as long as e is small 
enough (so that 0.2 — > 0), there is a gap between (29) and (|3l|). In fact, Watrous showed 



that it is possible to make e exponentially small with only polynomial overhead for any instance 
of QSD [Wat02j by exploiting a "quantized" version of the polarization lemma in |SV97j . Thus, 
any protocol for deciding QSEP-CIRCUIT could also decide QSD, implying that QSEP-CIRCUIT is 
QSZK-hard. ■ 

Ideally, we would like to show that QSEP-CIRCUIT is a complete promise problem for QIP(2), 
but it is not clear to us how to do so. The obvious way to attempt this would be to reduce CLOSE- 
IMAGE to QSEP-CIRCUIT, but the problem is that CLOSE-IMAGE requires a general channel, 
whereas our protocol for QSEP-CIRCUIT has a very specific channel (one that applies a random 
permutation to the B systems and discards the last k — 1 of them). Alternatively, we could attempt 
to find a QSZK proof system for QSEP-CIRCUIT, but the protocol that we have given to show that 
QSEP-CIRCUIT E QIP(2) does not satisfy the zero-knowledge property because, in the case of a 
YES instance, the verifier ends up with a state close to a fc-extension of pab, which he could not 
have generated himself using a polynomial-time quantum circuit. 



6 NP-hardness of the quantum separability problem 

We now prove NP-hardness of QSEP-CIRCUIT by finding a reduction to it from the NP-hard matrix 
version of the quantum separability problem. The essence of the reduction is Knill's efficient 
encoding of a density matrix description of a state pab as a description of a quantum circuit to 
generate it [Kni95j. We begin by recalling the matrix version of the quantum separability problem: 

Problem 10 (WMEM e (M, N)) Given a density matrix pab £ ®T~In) with rational en- 

tries subject to the promise that either (i) pab £ S or (ii) mm aAB ^s \\pAB — &ab\\2 ^ e ? w ^h s no 
smaller than an inverse polynomial in MN, decide which is the case. 

Gharibian showed that the above promise problem is NP-hard [GhaTUj, so our task is just to find 
a reduction from WMEM £ (M,N) to QSEP-CIRCUIT. First, consider that we can diagonalize the 
matrix pab i n time polynomial in M N log(M N j Si) , where s\ is an error parameter characterizing 
the precision of the diagonalization in the trace distance. We then compute a purification l^p) R ab 
of pab to a reference system with dimension no larger than MN. Knill's algorithm gives a quantum 
circuit running on O (log (MN)) qubits that generates the state \4> P ) RAB |Kni95j . and this algorithm 
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Figure 5: A quantum circuit to implement a channel. The circuit has input qubits and ancillas in 
the state |0). The circuit outputs qubits in the environment system R (which are traced over) and 
qubits in systems A and B. 



runs in time polynomial in MN. Knill's algorithm outputs controlled single-qubit unitary gate 
descriptions with arbitrary precision, so we need to invoke the Solovay-Kitaev algorithm [DN06] 
to approximate each gate in Knill's circuit with unitaries chosen from a finite gate set, up to 
precision 82 /I where / is the number of gates in Knill's circuit. The Solovay-Kitaev algorithm runs 
in time polylogarithmic in l/e2 and produces a gate sequence with length polylogarithmic in l/s2- 
This whole procedure leads to a mixed state quantum circuit generating a state p' AB such that 
Wpab — PabWi — 5 i + The state p' AB will be used as the input to QSEP-CIRCUIT(5 C , 5 S ). 

Setting S c = s\ + 62 implies that any instance of WMEM £ for which pab £ <S, meaning case (i) 
of the promise, gets mapped to a YES instance of QSEP-CIRCUIT(5 C , 5 S ). For case (ii), we know 
from Matthews et al |MWW09| that 



min 



. „ „ 1 „ 

L n Wpab - ^ab||i_ LO cc > mm c \\Pab - ^ab|| 2 > 

v 153 °AB^S 



This in turn implies that 

11 / 8 
mm \\pab ~ ctabIIi-locc > ~j= - £1 - £2 
vab£o Vloo 

so if we choose S s = ej \f\^—E\—E2 then case (ii) gets mapped to a NO instance of QSEP-CIRCUIT(5 C , S s 
Moreover, because s\ +£2 can be made to shrink exponentially with the circuit size, the gap 5 S — 5 C 
remains inverse polynomial in the circuit size. In particular, the instance of QSEP-CIRCUIT(5 C , 5 S 
will be in QIP(2) for sufficiently small e, as determined by the promise in Theorem [8} 



7 Q IP-completeness of the channel quantum separability problem 

There is a straightforward variation of QSEP-CIRCUIT which is a complete promise problem for 
QIP(3) (and therefore complete for QIP [KWOOJ). In this variation, the input is a description of a 
circuit that implements a quantum channel with input system S and two output systems A and 
B. (The channel is implemented by a unitary circuit with qubits in an environment system R 
that are traced over.) Figure [5] depicts a circuit that implements such a channel. The task is to 
decide whether there is an input to the channel such that the output state on systems A and B is 
separable. 
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Problem 11 (QSEP-CHANNEL(5 C , 5 S )) Given is a mixed-state quantum circuit to generate the 
channel Ns^ab, having an n-qubit input and an m-qubit output, along with a labeling of the qubits 
in the environment system R and the output qubits for A and B. Decide whether 

1. Yes: There is an input to the channel ps such that the channel output Ns^ab (ps) is S c -close 
in trace distance to a separable state gab £ S: 

min \\Af s ^AB (ps) ~ <tab\\i < S c - (32) 

PS, °AB^S 

2. No: For all channel inputs ps, the channel output Ms^ab (ps) is a t least 5 s -far in 1-LOCC distance 
to a separable state: 

min \\Ns^AB (ps) ~ vab\\i- L occ ^ 5 *- 

Theorem 12 QSEP-CHANNEL(5 C , 6 S ) is QlP-complete if there are polynomial-time computable 
functions 5 C , 5 S : N — > [0, 1], such that the difference 5 2 s /8 — 2\/~5~ c is larger than an inverse polynomial 
in the circuit size. 

Proof. The proof of this theorem is almost identical to the proofs of Theorems [8] and |9j 

We first show that there is a three- message quantum interactive proof system for QSEP- 
CHANNEL. This is just the obvious modification of the circuit in Figure [3] so that it becomes 
a three-message proof system as in Figure [2^ a). In particular, the prover first prepares a state and 
sends it to the verifier. The verifier inputs this state to the circuit that implements the channel 
Ns^ABi and the rest of the proof system proceeds as in Figure [3| In the case of a positive instance, 



the prover can compute the states ps and gab m (32) from the description of the channel Ns^ab 



He generates ps with his first unitary operation and then proceeds by choosing his second unitary 
operation as if the state Ns^ab (ps) were gab- Following the same analysis as in the proof of 
Theorem |8j the maximum probability with which the verifier accepts in this case is no smaller than 
1 — 2\/~5~ c . In the case of a negative instance, by Lemma [TJ for every state Ms^ab (ps), there is 
some k polynomial in the circuit size such that the maximum probability with which the prover can 
make the verifier accept is no larger than 1 — ^/8. An upper bound on the maximum acceptance 
probability is 

max F (Ms^ab (us) , °ab) , 



a formula which follows from ( 14) and our previous analysis in the proof of Theorem|8j This leaves a 
gap of Sg/8 — 2 -\f5~c between completeness and soundness error (promised to be larger than an inverse 
polynomial) and it is known that this gap can be amplified [KW00J. Thus, QSEP-CHANNEL(5 C , 5 S ) 
e QIP. 

To show that QSEP-CHANNEL is QlP-hard, it suffices to exhibit a reduction from the QlP- 
complete promise problem QCD (Problem^ to QSEP-CHANNEL. This reduction is essentially the 
same as that in the proof of Theorem |9j except that the circuit in Figure [4] is modified so that 
the unitaries being controlled are the unitaries that generate the channels (rather than the ones 
that generate the states). In the case of a positive instance of QCD, there exists an input to 
the channels such that their outputs are nearly distinguishable, so that the output of the modified 
circuit is nearly separable. Also, in the case of a negative instance, the outputs of the channels for all 
inputs are nearly indistinguishable, so that it is possible to distill a Bell state from the output state 
of the modified circuit. The CHSH game argument then applies as well. Thus, QSEP-CHANNEL 
is QlP-hard. ■ 
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8 A two-message quantum interactive proof system decides the 
multipartite quantum separability problem 



After their seminal work on fc-extendibility as a test of separability for bipartite states |DPS02[ 
DPS04], Doherty et al. developed a notion of fc-extendibility for multipartite quantum states 
[DPS05]. Recently, Brandao and Christandl exploited this notion to construct a quasi-polynomial 
time algorithm that decides a variant of the multipartite quantum separability problem |BC12j . 
Brandao and Harrow then improved the runtime of the algorithm by proving a stronger quantum 
de Finetti theorem that is applicable to the multipartite case [BH12j. 

In this section, we extend our results from Section [4] to the multipartite case by using the results 
in |BH12j . In particular, we formulate a variant of the multipartite quantum separability problem 
that we name MULTI-QSEP-CIRCUIT. 

We begin with a few definitions before proceeding to the main theorem of this section. A 
multipartite quantum state with / parties A\ , . . . , A\ is fully separable if it can be written in the 
following form: 

VAr.-'.A, = ^Px(x) \^1){^1\a 1 ^'''®\^)(^ 1 x \a 1 (33) 

x^X 

Let S denote the set of /-partite fully separable states. (We omit the dependence on the number 
of parties, /, which should be clear from context.) 

The notion of fc-extendibility extends in a natural way to multipartite systems. For notational 
simplicity, we refer to the total system which we are extending as C, and the / subsystems of 
C as Ai, Ai, . . . , A\. For example, we abbreviate (JAr.----.Ai simply as gq- A multipartite state 
PC — pAr.----.Ai £ {%a ® ' ' ' ® Wai) is ^-extendible [DPS05J if there exists a state ucc 2 ---C k £ 
V {U c ® Uc 2 ® • • • ® Uc k ) such that 

1. Each Hilbert space Ha j is isomorphic to Haj f° r all i G {1, . . . , k) and j E {1, . . . , /}. (We 
are using the notation Cij to refer to the j th subsystem of C{.) 

2. For all parties j E {1, . . . , /}, the state 0Jcc 2 ---C k is invariant under permutations of the systems 
Cij through Ckj- Note that there are / • k\ such permutations. 

3. The state ucc 2 ---C k is an extension of pc'- 

PC = Tic 2 ...c k {uJcc 2 -c k } • 



Let Ek denote the set of fc-extendible states for / parties (again suppressing the dependence of 
£k on / as it should be clear from context). A fully separable state &Ar ••■ -.Ai of the form in (33) has 
a fc-extension of the following form for all k: 



5>x(z) (I^X^UO®*®---®^)^!^) *, (34) 



o x (x) (I^X^k)" ""®---® [WxWx^ 

which can be purified as 

,<S>k 



b ^k)R'CC 2 -C k = VPX^)\ X )R' (I^x>Ai) ® • • • ® (\^ 1 x )ai) (35) 
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Problem 13 (MULTI-QSEP-CIRCUIT(5 C , S s )) Given is a mixed-state quantum circuit to gener- 
ate the n-qubit state pc, along with a labeling of the qubits in the reference system R and the output 
qubits for each system Ai, . . . , A\ E C . Decide whether 



1. Yes: There is a fully separable state gq £ S that is 8 c - close to pc in trace distance: 

min \\p c - crcWi ^ d c . 

2. No: All fully separable states are at least 5 s - far from pc in 1-LOCC distance: 

min \\p c - oclx-LOCC > s 8- 

The promise on negative instances is in terms of the multipartite 1-LOCC distance defined in 
[BHT2] : 

\\pA 1 :-.:A l ~ °Ay. - :A Z || 1-LOCC = A maX A ll( J -Ai ® A 2 ® ■ ■ • ® Aj) (p Al : - :A t ~ ° Ay. - 111 , (36) 

where A2, • • • , Aj are quantum-to-classical channels. 

Theorem 14 MULTI-QSEP-CIRCUIT(5 C ,5 S ) E QIP(2) if there are polynomial-time computable func- 
tions 8 C ,8 S : N — > [0, 1], 5^c/i t/iat the difference 5^/8 — 2\/~5~ c is larger than an inverse polynomial 
in the circuit size. 

Proof. The proof system for MULTI-QSEP-CIRCUIT is similar to that of QSEP-CIRCUIT, in the 

sense that it amounts to a quantum computational test for multipartite fc-extendibility. We exploit 
a generalized version of Lemma [T] that applies to multipartite states. This lemma follows from 
Theorem 2 of Brandao and Harrow [BH12J, and we provide a proof for it in the appendix. 

Lemma 15 Let pc be e-away in one-way LOCC distance from the set of fully separable states, for 
some e > 0: 

min l|pc - vcWulocc^ e - 
Then the state pc is S-away in trace distance from the set of k- extendible states: 

min \\p c - acWi ^ ^ 

for 5 < e and where 

*=fi + ^ii. 

(e — o) z 

Figure [6] depicts a two-message quantum interactive proof system for MULTI-QSEP-CIRCUIT. 
The protocol begins with the verifier preparing the state \ifjp) RC , a particular purification of pc, 
by running the quantum circuit U p as given in the problem instance. The verifier transmits the 
reference system to the prover, who then acts on R and some ancillary qubits with a unitary P\ that 
has output systems R f , C2, . . . , The prover transmits systems C2, . . . , to the verifier. The 
verifier then performs phase estimation over the symmetric group |Kit95[ lBBD + 97] (also known 
as the "permutation test" |KNY08| ) on the registers C, C2, . . . , Cfc, using the qubits in system D 
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Figure 6: A two-message quantum interactive proof system for MULTI-QSEP-CIRCUIT. As in the 
bipartite case, the protocol begins with the verifier executing the circuit U p that generates the 
state pc- He sends the reference system to the prover. In the case that pc is fully separable, the 
prover should be able to act with a unitary on the reference system and some ancillas in order to 
generate a multipartite fc-extension of pc to the systems C2 through Ck- The prover sends all of 
the extension systems back to the verifier, who then performs phase estimation over the symmetric 
group (a quantum Fourier transform followed by a controlled permutation) in order to test if the 
state sent by the prover is a multipartite fc-extension. 



as the control. This control register requires [log(/ • k\)~\ qubits because the permutations included 
in the test are those from the definition of multipartite fc-extendibility. The verifier performs a 
computational basis measurement on all of the qubits in the control register D and accepts if and 
only if the measurement outcome is all zeros. This protocol operates nearly exactly as the bipartite 
case does, except that the verifier asks for fc-extensions of all the systems instead of just one. The 
analysis of the protocol proceeds almost identically to the analysis in Section [4j however we state 
it here explicitly for clarity. 

In a YES instance, there is some fully separable state ac E S that is 5 c -close in trace distance 
to pc- By Uhlmann's theorem in Q and the Fuchs-van-de- Graff inequalities in Q, there exists a 
purification of ac such that 

IH^p) ^p\rc - I^M (^\rc\\ ^ 2 \ / ^c- (37) 

As such, the prover can operate by providing a fc-extension for the separable state ac instead, 
giving a lower bound on the probability that the verifier accepts. Letting U be the unitary that 
includes the prover's operation Pi and the verifier's permutation test, we have that 



Tr {|0> <0| D £/(|W> ^ P \ RC )U ] } > 1 - 2y/6~ c , 



where the inequality follows exactly the same line of reasoning as the steps in (17) by exploiting 



([37J) instead. 

The analysis of a NO instance also proceeds similarly to that of the bipartite case, but the 
channel generated by the inverse of the verifier's circuit conditional on accepting is now given by 

Mcc 2 -C k ^CD (vcc 2 -C k ) = Trc 2 -c fc |Vn)cc 2 ...C fc D Occ 2 -C fc ® |perm) (perm| D ) (^n)^...^} ; 
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where (Uu)cc 2 ---C k D is a controlled-permutation operation denned similarly to that in (19), and 



the permutations involved are those from the definition of multipartite fc-separability. Also, |perm) 



is defined similarly to (18), though it is a uniform superposition of all possible / • A:! permutations 
required from the definition of multipartite fc-extendibility. Tracing out the control register D gives 
the following upper bound on the acceptance probability: 

max F(pc, Mcc 2 ...C k ^c(<7CC 2 -C k ), (38) 
°cc 2 ...c k 

where Mcc 2 ...C k ^C is a channel that applies a permutation selected at random from the multipar- 
tite fc-extendibility permutations and then discards the systems C2, . . . , As in the bipartite 
case, since the channel Mcc 2 - C k ^C symmetrizes the state of the systems CC2 • • • Cfc, the maximum 



in (38) is achieved by a state crcc 2 ---C k which is permutation symmetric with respect to the multi- 



partite fc-extendibility permutations. As such, we can rewrite (38) as the maximum fc-extendible 
fidelity of pc'- 

max F(pc,Mcc 2 ...C k ^c(<7CC2-C k ) = maxF(pc,crc). (39) 



By Lemma [151 if we take k to be larger than 

4/ 2 log|C| 



1 + 



(Ss-6: 



M2 



then 



mm \\p c - (7c\\i > S' s , 



for 5' s strictly less than 6 S1 which we can enforce by setting 8 r s — 5 s / y/2. Observe that k is polynomial 
in the circuit size because the number of parties cannot exceed the number of qubits upon which 
the circuit acts, it is only linear in the number of qubits in system C, and the promise guarantees 
that 1/Sg is polynomial in the circuit size. Then, using the same analysis as in the bipartite case 
124| ), we have that 

max F(pc^c) <l-S 2 s /8. 

In the above we have obtained the same separation between completeness and soundness error as 
in the bipartite case. As discussed in Section[4j this is sufficient to place the protocol in QIP(2). (See 
Section 3.2 of Ref. [JUW09] for how to amplify an inverse polynomial gap.) Thus, we have given a 
two-message quantum interactive proof system that decides the multipartite quantum separability 
problem. ■ 

Note that MULTI-QSEP-CIRCUIT is also QSZK- and NP-hard, as the bipartite separability 
problem is merely a special case of the multipartite separability problem. Also, it should be clear 
that if we define a "channel" variant of MULTI-QSEP-CIRCUIT that is the natural combination 
of MULTI-QSEP-CIRCUIT and QSEP-CHANNEL, such a promise problem is QlP-complete by the 
analysis in this and the previous section. 

9 Conclusion 

We have provided the first nontrivial example of a promise problem that is in QIP(2) and hard for 
both QSZK and NP. We accomplished this by introducing a version of the quantum separability 
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problem in which the input string is the specification of a quantum circuit that generates a mixed 
bipartite state pab, along with a promise that the state is close in trace distance to some separable 
state or there is no separable state close to it in 1-LOCC distance. We showed that this promise 
problem, called QSEP-CIRCUIT, is decidable by a two-message quantum interactive proof system, 
and we also proved that it is hard for quantum statistical zero knowledge (QSZK) proof systems. 
Our results in Section [6] also demonstrate that QSEP-CIRCUIT is hard for NP. Finally, we considered 
a natural variation of the quantum separability problem, in which the circuit generates a channel 
rather than a state, and the goal is to determine if there is an input to the circuit for which the 
output across some bipartite cut is separable. The "channel quantum separability problem" is 
complete for QIP, the class of promise problems decidable by general quantum interactive proof 
systems. Furthermore, we have shown that a two-message quantum interactive proof system can 
decide a variant of the multipartite quantum separability problem in which the input and promises 
are similar to those from QSEP-CIRCUIT. 

Not much is currently known about two-message quantum interactive proof systems (QIP(2)), 
other than a nontrivial lower bound on it given by Wehner [Weh06j and the containment QSZK C QIP(2) 
[Wat02 ; Wat09b]. Also, CLOSE-IMAGE is a complete promise problem for QIP(2), but it really just 
amounts to a trivial rewriting of the definition of QIP(2), much like the relationship between CLOSE- 
IMAGES and QIP(3) jKWOOl IRW051 IRos09] . The promise problem QSEP-CIRCUIT seems to have 
a natural two-message quantum interative proof system that does not satisfy the zero-knowledge 
property (if the verifier in our protocol were able to generate a fc-extension himself, then he would 
be able to solve the problem efficiently in BQP, but our hardness results suggest that this should 
not be the case). Thus, it seems possible that one might be able to show that QSEP-CIRCUIT is 
in fact QIP(2)-complete, but a proof evades us for now. It is nonetheless suggestive that a simple 
variation of QSEP-CIRCUIT (QSEP-CHANNEL) leads to a QlP-complete promise problem. Also, 
since it is unclear how to begin to show that QSEP-CIRCUIT is QIP(2)-hard, it would be desirable 
to show that QSEP-CIRCUIT is QMA-hard, given that QMA C QIP(2) and QSZK C QIP(2), and 
QMA and QSZK are not known to be commensurate complexity classes. 
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A Appendix 

A.l Approximate fc-extendibility 

The following proposition applies to bipartite states that are approximately fc-extendible: 
Proposition 16 Let pab be 5-close to a k-extendible state, in the sense that 

min \\pab ~ °Ab\\i < ^ (40) 

(JAB^k 
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for some 8 > 0, where 8k is the set of k-extendible states. Then, the following bound holds 

1/2 



\pab-S\\ ulocc < (l61n2 ^ +5 . 



Proof. The proof of this theorem requires only a simple modification of the original proof of 
Brandao et al. [BCYllbj . First, recall that the squashed entanglement of some bipartite state ujab 
is equal to E sq (uja-.b) = \ inf {/ (A; B\E) U , : ujab = Tr^ {ujabe}} |C W04 ] . Let a AB be the state 
that achieves the minimum in (40), and let o'AB 1 ---B k ^ e a ^-extension of cr f AB . (The fact that such 
a minimum exists follows from the argument above (21).) Following Brandao et al., observe that 

log 1^1 > E^{o f AlBv .. Bh ) 
k 

>^2 E ^A:B t ) 

= kE sq (a A:B ) 



> k 



The second inequality is from monogamy of squashed entanglement. The final inequality exploits 
a theorem of Brandao et al. The above implies that 



16 In 2 ( — ) > min \W AB - g A b II, 

\ K J (JAB^S 



LOCC ' 

Let a* AB be the state achieving the minimum in min aAsG £ IWab ~ ^^Hi-LOCC* ^ e then nave that 

\\ a AB - ^AbHi.loCC + ^ — || °AB — ^AbHi.loCC + II " AB ~~ P^lli 

> ~ ^abILlocc + ~ ^lll-LOCC 

> \\pAB - ^ABlll-LOCC 

> min \\pab - (tabWllocc ■ 

From this, we conclude the statement of the proposition. ■ 

The following proposition applies to /-partite states pc = pA 1 :A 2 :~-.A l that are approximately 
fc-extendible: 

Proposition 17 Let pc be 5-close to a k-extendible state, in the sense that 

min \\p c - crcWi < (41) 
for some 5 > 0, where is the set of k-extendible l-partite states. Then, the following bound holds 



4Plog\C\ 
\\PC-S\\i.LOCC^ V k-l 

where the quantity on the left is multipartite 1-LOCC distance (defined in $3(fy) to the set of fully 
separable states. 
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Proof. Let o' c be the state that achieves the minimum in (41). Since this state is fc-extendible, 
we have from Theorem 2 of [BH12] that 



■ ii / ii /4P log ICI 

mm \\a c - a c l_ LOCC < ^-j^j-, ( 42 ) 



Let <Jq be the state achieving the minimum on the left in (42). From the premise of the theorem, 
it follows that 

\\°C - a c||i_ LO CC + 6 > \\ a C ~ a c||i_ LO CC + \\ a C ~ Pc||i 

> \\a c - ^c||i_LOCC + \\ a C ~ ^lll-LOCC 

> \Wh - Pc||i_LOCC 

> mm hc-pch-Locc- 



Thus, 



mm 

cr c ^S 



Wc ~ Pc|li_LOCC < \\ a C ~ a c||i_ LO CC + S 



which concludes the proof. ■ 
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